Windows Forum

Ask something
Discussion Locked

DNS and RRAS VPN problem

0 helpful
5 replies

by gareth watson 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
When my users are dialled in via our VPN provided by a windows 2000 RAS server they cannot access our internal DNS servers. The requests time out. Has anyone got a solution to this problem? I have tried many things including making the RAS machine a DNS server itself but no joy. Any and all help appreciated.

5 replies

by an_it_guy

Do they really need to access your internal DNS Servers?
If you can use the hosts file that were used some time back.. You can make entries of all the servers that these users r expected to connect to over the LAN. Not sure if that works, but maybe you can keep a copy of this Hosts file on the RAS server too - to which they connect.

by gareth watson

The hosts file is not an acceptable solution I have too many servers that change names and roles to keep this file up to date.

by cg it

what exactly is the problem? If the problem is that users are unable to connect and authenticate with the network via dial up remote access more information is required such as is a firewall in place?, Active Directory running, what authentication method you are using? Is RRAS properly configured? Is the modem listed in RRAS properly configured? and so on

by kmcniff

RRAS will provide DHCP for the remote clients. In order to have the client use the configurations on a local DHCP server, you need to add the DHCP Relay agent to the WAN port of the RRAS server. This will allow the VPN client to access the DHCP server and get the DNS servers set on the remote VPN client.
The other problem could also be if you are using ISA to provide RRAS and VPN. In that case, you will need to configure ISA to allow TCP port 53(DNS) from any to any and UDP Port 53 from any to any.

by gareth watson

hmmm not sure about this one. I will cut to the chase and say ISA is not implemented at our site. We do have a firewall though I do not see the requirement for dns to be allowed into the network when the traffic is originating from outside this would be a major security issue.

I am not sure about the inner workings of ISA but if it is a stateful firewall then inbound replies will be allowed in and a rule stating allow port 53 traffic from anywhere will not be required.

This discussion is closed to new replies.